A missing padlock on a site that has a valid certificate is mixed content: the page came over https and something inside it did not. The browser blocks or downgrades, and the padlock goes.

Find it in one place

The console names the exact URL. Guessing which image it is wastes far more time than opening it.

// browser console\nMixed Content: The page at 'https://...' was loaded over HTTPS,\nbut requested an insecure resource 'http://...'.

Where it usually comes from

  • Absolute http:// URLs in the database - written when the site was http and never updated.
  • A hard-coded script or font URL in a theme.
  • An embed - a map, a video, a widget - whose provider is still on http.

Fix the database

wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables --precise
Back up before a search and replace. It rewrites every table, and serialized data can be corrupted by a naive replace - use a tool that understands serialization, which wp search-replace does.

Catch the rest

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

That tells the browser to fetch http subresources over https instead. It is a safety net for things you do not control, not a substitute for fixing your own URLs - if the other end has no https, the resource fails.

Prefer protocol-relative? No

//example.com/x.js was the old answer and is now discouraged: on a page opened locally over file:// it breaks, and it hides which protocol is intended. Write https:// explicitly.

After fixing, hard-reload. The browser caches the mixed-content verdict for the page and will keep showing the broken padlock from cache.